Post-Quantum Signal Key Agreement with SIDH - Cryptology ...
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Post-Quantum Signal Key Agreement with SIDH
Samuel Dobson and Steven D. Galbraith
Mathematics Department, University of Auckland, New Zealand.
samuel.dobson.nz@gmail.com, s.galbraith@auckland.ac.nz
September 21, 2021
Abstract
In the effort to transition cryptographic primitives and protocols to quantum-resistant alternatives, an
interesting and useful challenge is found in the Signal protocol. The initial key agreement component of
this protocol, called X3DH, has so far proved more subtle to replace—in part due to the unclear security
model and properties the original protocol is designed for. This paper defines a formal security model
for the original Signal protocol, in the context of the standard eCK and CK+ type models, which we call
the Signal-adapted-CK model. We then propose a secure replacement for the Signal X3DH key exchange
protocol based on SIDH, and provide a proof of security in the Signal-adapted-CK model, showing
our protocol satisfies all security properties of the original Signal X3DH. We call this new protocol SI-
X3DH. Our protocol refutes the claim of Brendel, Fischlin, Günther, Janson, & Stebila [Selected Areas in
Cryptography (2020)] that SIDH cannot be used to construct a secure X3DH replacement due to adaptive
attacks. Unlike the generic constructions proposed in the literature, our protocol achieves deniability
without expensive machinery such as post-quantum ring signatures. It also benefits from the efficiency
of SIDH as a key-exchange protocol, compared to other post-quantum key exchange protocols such as
CSIDH.
1 Introduction
Signal is a widely-used secure-messaging protocol with implementations in its namesake app (Signal), as well
as others including WhatsApp, Facebook Messenger and more. Due to its popularity, it is an interesting
problem to design a post-quantum secure variant of the protocol. However, some difficulty arises due to the
lack of formally-defined security model or properties for the protocol itself.
The Signal protocol consists of two general stages: the first is the initial key agreement, which is then
followed by the double ratchet protocol. The initial key agreement is currently done via a protocol known
as Extended Triple Diffie-Hellman (X3DH) [MP16]. While Alwen et al. [ACD19] construct a version of
the double ratchet component using KEMs that can be made post-quantum secure, the X3DH stage has
proven to be more subtle and challenging to replace in an efficient way with post-quantum solutions. Recent
work by Brendel et al. [BFG+ 20] examines some of these challenges, and suggests that SIDH cannot be
used to make X3DH post-quantum secure due to its vulnerability to adaptive attacks when static keys are
used. For an isogeny-based variant of Signal they suggest using CSIDH [CLM+ 18], however this primitive
is much less efficient than SIDH in part due to subexponential quantum attacks that lead to much larger
parameters.
Specifically, there is an adaptive attack on SIDH by Galbraith, Petit, Shani, and Ti [GPST16] (henceforth
referred to as the GPST attack), which uses specially crafted points in a user’s public key to extract bits of
information about the isogeny path (and thus the secret key) of the other participant. This attack cannot
be detected using tools such as pairings. One proposed method of overcoming this attack, known as k-
SIDH [AJL17], runs many instances of the SIDH protocol in parallel and combines all the shared secrets
1using a hash function in the final step of the protocol. However, the adaptive attack was extended to k-SIDH
in [DGL+ 20] and shown to be feasible for small k (an attack on k = 2 is demonstrated concretely). Due to the
possibility of attacking k-SIDH for small k, it has been suggested that k of at least 92 would be required to
achieve security against quantum adversaries. Unfortunately, this makes the protocol very inefficient.
An alternative which is commonly used, as in SIKE [CCH+ ], is to convert the key exchange into a key
encapsulation mechanism (KEM) using the Fujisaki-Okamoto (FO) transform or its variants [HHK17], and
verify that the public key is well-formed and honestly generated [Pei14, KLM+ 15]. The idea of the FO-
transform is that the initiator, A, of the key exchange can encrypt the randomness they used in the exchange
(for example, to generate their secret key) under the symmetric shared key K they derived, and send it to
their partner B. If the encryption method is one-time secure, then because only A and B know K, only they
can decrypt this randomness. B can then check that A performed the exchange protocol correctly, and in
particular, that the public key they generated is indeed derived from the randomness they provided, to prove
that A’s public key is well-formed. Clearly though, because B learns the secret key of A in every exchange,
A can only do this with ephemeral keys. Hence, while extremely useful, the FO-transform does not provide
a solution in cases where both parties use static keys.
Other efforts to formalize the security properties of the Signal protocol and X3DH include the work by
Cohn-Gordon et al. [CGCD+ 20] on proving security of Signal, and the very recent work of Hashimoto
et al. [HKKP21] proposing a generic security model (for what they call Signal-conforming AKEs) for the
Signal initial key agreement and a generic construction from KEMs and signature schemes (as mentioned
above, KEMs do not allow static-static key exchange, so a signature scheme is required to provide explicit
authentication of the initiating party). From these analyses of the protocol, the following security properties
have been identified as important, which any post-quantum replacement should also satisfy:
1. Correctness—if Alice and Bob complete an exchange together, they should derive the same key.
2. Secrecy / Key-indistinguishability under corruption of various combinations of participants’ secret keys,
for example the CK model [CK01] or the model in [CGCD+ 20].
3. (Implicit) authentication of both parties.
4. Perfect forward secrecy (PFS).
5. It can be made asynchronous/non-interactive by hosting participants’ public keys on a third party
server, which is untrusted. The only possible malicious ability the server has is that it could deny Alice
the retrieval of Bob’s keys (or, say, not give out his one-time keys). This property is called receiver
obliviousness in [HKKP21].
6. Identity-hiding / (Offline) deniability [VGIK20]—a transcript should not reveal the participants of the
exchange.
Our first goal of this work is to show that SIDH can indeed be used to construct a post-quantum X3DH
replacement, which satisfies the same security model as the original X3DH protocol, despite Brendel et
al. [BFG+ 20]’s claim. We propose a new, efficient, post-quantum key exchange protocol using SIDH, modelled
after X3DH, which we call SI-X3DH. This new protocol solves the problem of adaptive attacks by using a
variant of the Fujisaki-Okamoto (FO) transform to prove that Alice’s ephemeral key is honestly generated,
and a proof of well-formedness on each party’s long-term keys, which only needs to be verified once (and
could be offloaded to the PKI server depending on the trust model used). Because SIDH is an efficient
post-quantum key exchange proposal with very small key sizes, and SI-X3DH requires only three or four
SIDH exchanges (unlike k-SIDH), our protocol is also efficient and practical. For example, SIDH is much
faster than CSIDH, used in Brendel et al. [BFG+ 20]’s proposal, because CSIDH uses larger prime degree
isogenies while SIDH commonly uses only 2 and 3 (including SIKE, although there are some variants which
use other primes such as eSIDH [COR21]). Our scheme also does not rely on expensive machinery such as
post-quantum ring signatures to achieve deniability (as [HKKP21] does). The efficiency of our scheme is
discussed more in Section 7.
2Due to the asymmetry between isogeny degrees in SIDH, our protocol requires users to register two keys
rather than one (a receiving key and a sending key). SI-X3DH is agnostic to the signature scheme Signal uses
to sign semi-static keys, so any efficient post-quantum signature scheme may be used alongside it—there is
no restriction to use isogeny-based schemes. The only additional overhead required by SI-X3DH is a single
FO-proof per exchange, and a once-off proof of well-formedness of each party’s identity keys (see Section 5
for discussion of this). We also claim that SI-X3DH more closely models the original X3DH protocol in
structure—for example, allowing Bob the balance between one-time keys (which may be exhausted leading
to denial of service) and medium-term/semi-static keys which may provide less security in certain situations.
These properties and differences are discussed further in Section 4.
While there are some differences between our protocol and X3DH (in particular, SI-X3DH uses DH(IKA , IKB )
while previously X3DH used DH(IKA , SKB )—this notation is defined in Section 2), we give a proof of se-
curity for our new SI-X3DH protocol, and show that it satisfies the security properties of the original
Signal protocol. In doing so we also discuss the main point of failure for X3DH not satisfying the eCK
or CK+ security model—key-compromise impersonation (KCI) attacks—and the impact this change from
DH(IKA , SKB ) to DH(IKA , IKB ) has on the security of the protocol.
1.1 Related work
Brendel et al. [BFG+ 20] proposed a new model for post-quantum X3DH replacements using a primitive
they call split-KEMs. Their construction is a theoretical work as they leave it an open question whether
post-quantum primitives such as CSIDH do satisfy the security definitions of their split-KEM.
Very recently, Hashimoto et al. [HKKP21] presented their Signal-Conforming AKE construction, also using
post-quantum KEMs to construct a generic Signal X3DH replacement. To achieve deniability, their scheme
requires a post-quantum ring signature scheme. Independently, but following a very similar approach to
Hashimoto et al., Brendel et al. [BFG+ 21] also proposed a deniable AKE using post-quantum KEMs (which
they call “Signal in a Post-Quantum Regime” (SPQR)) and a designated verifier signature (DVS) scheme.
As they mention, little work has been done to date in constructing DVS schemes from post-quantum as-
sumptions, so Brendel et al. also propose using a two-party post-quantum ring signature scheme for the
same purpose.
We briefly outline the differences between these two works and this paper using the following table.
Scheme PQ-secure Deniable Requires sig Long-term data Exchanged data
Original Signal
x X X K 3 keys
X3DH protocol
Split-KEM based 3 keys,
X ? X K, Kσ
X3DH [BFG+ 20] 4 ciphertexts
Signal-Conforming *with PQ 1 key,
X X(×2) K, Kσ , Kσ∗
AKE [HKKP21] ring signature 3 ciphertexts
*with PQ ring 2 keys,
SPQR [BFG+ 21] X X(×2) K, Kσ , Kσ∗
signature / DVS 4 ciphertexts
SI-X3DH K2 , K3 , Kσ 3 keys,
X X X
(this work) + PoK 1 ciphertext
Table 1: Comparison of post-quantum Signal X3DH replacements. Long-term data refers to the size of the
initial registration cost for each user (the “offline” data). Exchanged data gives the amount of ephemeral
data sent in a single exchange (by both parties combined), that is, the size of the “online” transcript. Note
that all schemes require a signature scheme (Requires sig) to obtain PFS—post quantum schemes use a
separate signature verification key Kσ while Signal X3DH reused the same key K for both exchange and
signature verification (ECDH and XEdDSA [Per16]).
3The Split-KEM protocol [BFG+ 20] does not discuss the requirement for a signature scheme on the semi-
static keys, but clearly the same attack on PFS applies to their scheme as it does to the original Signal
X3DH protocol if the semi-static keys are not signed—a malicious server or tampering man-in-the-middle
can insert their own semi-static key rather than Bob’s, and later compromise Bob’s long-term identity key,
thus allowing recovery of the shared secret. The Signal-Conforming AKE protocol and SPQR protocol
require this signature for PFS too, for the same reason, but also use a second (ring/DVS) signature from the
key exchange initiator on the session ID—two signatures per exchange. Because ring signatures and DVS
schemes are much more expensive than standard signatures, for efficiency it would likely be preferable to use
two separate schemes, hence the two signing keys Kσ , Kσ∗ in Table 1. Our construction, as mentioned above,
requires a single signature on the semi-static key. Because there are no efficient post-quantum constructions
with a public key that can be used in both a signature scheme and a key exchange, requiring a separate
signature scheme (and verification key) seems unavoidable for any post-quantum X3DH replacement.
For deniability, SC-AKE requires the initiator of the key exchange to sign the session ID. This signature
creates non-repudiable evidence of the initiators involvement in the exchange. Hashimoto et al. [HKKP21]
and Brendel et al. [BFG+ 21] suggest using a ring signature to attain deniability, however a post-quantum
ring signature scheme is a much more expensive construction. Deniability of the split-KEM construction is
not discussed by Brendel et al., and would appear to depend on how the split-KEM is instantiated.
Finally, it is important to note that the SC-AKE does not use a semi-static key—only long-term and
ephemeral keys. This means that unlike in Signal X3DH, if a receiver is offline for an extended period
of time, it is possible for all the ephemeral keys they uploaded to the server to be exhausted (either due to
popularity or a malicious attempt to do so). This creates an opportunity for denial of service which is not
present when semi-static keys are used and the ephemeral component is optional. Brendel et al. [BFG+ 21]
address this by using a semi-static and an ephemeral KEM encapsulation key if available, as in Signal’s
X3DH.
1.2 Outline
We shall begin in Section 2 by reviewing the existing X3DH protocol used as Signal’s initial key agreement.
We will then review the supersingular isogeny Diffie-Hellman key exchange (SIDH) in Section 3. In Section 4
we shall discuss the security properties of an appropriate Signal key agreement protocol in more detail and
define a security model to be used. This is followed by our construction of a new protocol in Section 5
using SIDH, which we propose is an efficient post-quantum replacement for X3DH. Section 6 gives a proof of
security for this construction, and Section 7 discusses the efficiency of our protocol and the key differences
between our proposal and the original X3DH scheme.
1.3 Acknowledgements
We thank the anonymous reviewers for their helpful comments and feedback. We also thank Jason LeGrow
for his feedback and advice.
2 The Signal X3DH protocol
The basic process of the X3DH protocol is given in Figure 1, where Alice is the initiator and Bob is the
responder. Let DHg (g a , g b ) = g ab denote the result of a Diffie-Hellman key exchange between keys A and B
(at least one of the private keys is needed to compute this, but the result is unambiguous).
Note that throughout this paper, we will use brackets [X] to denote an optional parameter which may be
omitted.
Because the X3DH protocol is designed to work when the recipient (Bob) is offline, Alice obtains his public
key information from a server. IKA and IKB are the fixed long-term identity keys of Alice and Bob
4Alice Server Bob
register IKB
i }
upload SKB , SigB (SKB ), {EKB i
request prekey bundle
IKB , SKB , SigB (SKB ), [EKB ]
IKA , EKA , [fingerprint(EKB )]
DH1 = DH(IKA , SKB )
DH2 = DH(EKA , IKB )
DH3 = DH(EKA , SKB )
[DH4 = DH(EKA , EKB )]
SK = KDF(DH1 k DH2 k DH3 k [DH4 ])
Figure 1: The X3DH protocol [MP16]. DH4 is optional on the basis of one-time key availability.
respectively. Bob additionally uploads a semi-static public key SKB signed by him to the server, which he
rotates semi-regularly. He also uploads a number of one-time keys EKB , but the use of these is optional as
the supply on the server may run out.
After Alice has received Bob’s identity, semi-static, and (optional) one-time keys from the server, she performs
a three- or four-part key exchange with her own identity key and ephemeral key. These three or four shared
keys are specified in the figure, and are combined with any secure key derivation function (KDF), for
example a secure hash function. This results in the master shared secret for the exchange, which is then
used in subsequent protocols such as Signal’s Double Ratchet protocol.
Finally, Alice sends to Bob identifiers of which of his semi-static and one-time public keys she used (for
example, short fingerprint), as well as her own identity and ephemeral keys. This allows Bob to also compute
the same shared master secret.
Verification of the long-term identity keys is out-of-scope for the protocol, and may be done either by
trusting a third party (e.g. the server) as a PKI, or verifying the keys in-person or out-of-band in some other
way.
3 SIDH
We now provide a brief refresher on the Supersingular Isogeny Diffie-Hellman (SIDH) key exchange protocol
[JDF11, DFJP14] by De Feo, Jao, and Plût.
As public parameters, we have a prime p = `e11 ·`e22 ·f ±1, where `1 , `2 are small primes, f is an integer cofactor,
and `e11 ≈ `e22 . We work over the finite field Fp2 . Additionally we fix a base supersingular elliptic curve E0
and a basis {Pi , Qi } for both the `1 and `2 torsion subgroups of E(Fp2 ) (such that E0 [`ei ] = hPi , Qi i).
Typically `1 = 2 and `2 = 3, and this will be assumed from here forward in this paper. We will use both the
index 1 and the subscript A to represent Alice’s information, while B ' 2 will be used interchangeably for
Bob’s, for clarity in various situations and for consistency with existing literature.
It is well known that knowledge of an isogeny and knowledge of its kernel are equivalent, and we can convert
between them at will, via Vélu’s formulae [Vél71]. In SIDH, the secret key of Alice (respectively Bob) is an
isogeny φ : E(Fp2 ) → EA (Fp2 ) of degree 2e1 (respectively 3e2 ). These isogenies are generated by randomly
5choosing a secret integer α ∈ KA and computing the isogeny whose kernel K = hPA + [α]QA i1 . We thus
unambiguously refer to the isogeny, its kernel, and such an integer α, as “the secret key.” Figure 2 depicts
the commutative diagram making up the key exchange.
φA
E EA
φB φAB
EB EAB
φBA
Figure 2: Commutative diagram of SIDH, where ker(φBA ) = φB (ker(φA )) and ker(φAB ) = φA (ker(φB )).
In order to make the diagram commute, Alice and Bob are required to not just give their image curves EA
and EB in their respective public keys, but also the images of the basis points of the other participant’s
kernel on E. That is, Alice provides EA , PB0 = φA (PB ), Q0B = φA (QB ) as her public key. This allows
Bob to “transport” his secret isogeny to EA and compute φAB whose kernel is hPB0 + [β]Q0B i. Both Alice
and Bob will arrive along these transported isogenies at distinct, but isomorphic, image curves EAB , EBA .
Two elliptic curves are isomorphic over Fp2 if and only if their j-invariants j(EAB ) = j(EBA ), hence this
j-invariant may be used as the shared secret of the SIDH key exchange.
Throughout this paper, we will use the function SIDHpp (·, ·) to represent this protocol with respect to public
parameters pp, outputting the final j-invariant. Generally, the public parameters will be clear from context,
so they may be omitted for ease of notation. The arguments to SIDH will be the two public keys of the
participants, because clearly the result is independent of which participant computed the value (using their
secret key). Specifically, if β is the secret key corresponding to the public key KB = (EB , PA0 , Q0A ), then
SIDHpp ((EA , PB0 , Q0B ), KB ) = j(EA /hPB0 + [β]Q0B i).
3.1 SIDH assumptions
The standard computational and decisional hardness assumptions associated with the SIDH key exchange
are as follows. Let
SSECp,i = {(Ei , φi (P3−i ), φ(Q3−i )) | φi : E0 → Ei , deg φi = `ei i }
be the set of all possible public keys for participant i in the SIDH protocol. Let
SSJp = {j(Ei ) : Ei supersingular}
be the set of all possible supersingular j-invariants which could arise as shared secrets of an SIDH key
exchange.
Let pp denote the public parameters pp = (p, `1 , `2 , e1 , e2 , E0 , P1 , Q1 , P2 , Q2 ).
Computational Supersingular-Isogeny Diffie-Hellman (SI-CDH) Problem. Given the public pa-
rameters pp, and two public keys K1 = (E1 , P10 , Q01 ) ∈ SSECp,1 , K2 = (E2 , P20 , Q02 ) ∈ SSECp,2 , compute the
j-invariant j = j(E12 ) = j(E21 ) = SIDHpp (K1 , K2 ).
We define the advantage of a PPT adversary A solving the SI-CDH problem as
Advsi-cdh (A) = Pr[ j = SIDHpp (K1 , K2 ) | j ← A(pp, K1 , K2 ) ]
The SI-CDH assumption states that for any PPT adversary A, Advsi-cdh (A) ≤ negl
1 This uses the idea of equivalent keys from Galbraith et al. [GPST16], and only uses keys of the form (1, α), of which there
are 2e1 and 3e2 respectively. Restricting to such keys is standard in SIDH-based schemes, including SIKE.
6Decisional Supersingular-Isogeny Diffie-Hellman (SI-DDH) Problem. Let K1 = (E1 , P10 , Q01 ) ∈
SSECp,1 , K2 = (E2 , P20 , Q02 ) ∈ SSECp,2 be two public keys, and j-invariant j0 = j(E12 ) = j(E21 ) =
SIDHpp (K1 , K2 ) be their SIDH shared secret. Let j1 ←R SSJp . The SI-DDH problem is to distinguish
between j0 , j1 , given K1 , K2 .
We define the advantage of a PPT adversary A solving the SI-DDH problem as
1
Advsi-ddh (A) = Pr[ b = b0 | b0 ← A(pp, K1 , K2 , jb ), b ←R {0, 1} ] −
2
The SI-DDH assumption states that for any PPT adversary A, Advsi-ddh (A) ≤ negl.
Gap assumption. It has been observed, for example by Galbraith and Vercauteren [GV18], that an
oracle solving the SI-DDH problem can be used to solve the SI-CDH problem, making these two problems
equivalent. This means there exists no typical Gap-DH problem in the SIDH setting. We discuss this issue
and our workaround in Section 4.3.
4 Security model
Authenticated key exchange (AKE) security is a complex field of security properties and models. Of primary
interest is the notion of key indistinguishability, sometimes simply known as AKE security. The seminal work
by Bellare and Rogaway [BR93] defined a security model for authenticated key exchange (known as the BR
model). Security in the BR model is based on the indistinguishability of true session keys from random, even
when the adversary is given certain powers to control protocol flow and interactions, and to reveal long-term
secret keys and states. A number of other models have since been developed, based on this original BR
model, including the CK [CK01], CK+ [Kra05] and eCK [LLM07] models. These models all differ based
on the powers of the adversary in the key-indistinguishability game (as well as other differences such as
how partner sessions and session IDs are defined). The main difference between the CK/CK+ models and
the eCK model is that the latter uses ephemeral-key reveal queries while the former use session-state reveal
queries. These models are incomparable [Cre09].
The eCK and CK+ models are generally viewed as the strongest or most desirable models in this vein, as
they capture attacks which are outside the scope of the CK model—weak perfect forward secrecy (wPFS),
key compromise impersonation (KCI), and maximal exposure (MEX). All of these properties relate to certain
combinations of long-term and ephemeral keys being compromised by an adversary. Security in these models
relies on allowing the adversary all non-trivial combinations of exposure—i.e. any combination of keys from
both parties that does NOT form a vertex cover on the graph of Diffie-Hellman exchanges in the protocol
(the graph where nodes are keys and edges represent that a DH key exchange between the two incident keys
is used in the protocol). A vertex cover would trivially allow the adversary to compute the shared secret,
because at least one secret is known to the adversary in every DH exchange (edge). But if the adversary
does not have a vertex cover, the result of at least one DH exchange is not able to be computed (because the
adversary does not have either of the secret keys involved), so the overall session key of the protocol should
remain hidden. We refer the reader to the work of Fujioka et al. [FSXY12] for a more detailed analysis of
the difference between these models.
Unfortunately, Signal X3DH does not meet the definition of security required by all these models. This was
observed by Cohn-Gordon et al. [CGCD+ 20], as there do not exist edges in the exchange graph for every pair
of keys (e.g. there is no DH exchange between Alice’s identity key and Bob’s identity key or ephemeral key).
Our benchmark for security is that a replacement protocol should meet at least the same security definition
as that of the original protocol so we must observe where exactly the original protocol breaks down in the
eCK model. This allows us to propose a slightly weaker model, though still stronger than the CK model,
that successfully represents the security goals. This gives a more formal and well-defined security model
than Cohn-Gordon et al. [CGCD+ 20] used to prove security of the original Signal X3DH protocol, which
7used non-standard notation in an ad-hoc model. We call our new security model the Signal-adapted-CK
model.
The recent work of Hashimoto et al. [HKKP21] provided a similar security model, for what they call a Signal-
conforming AKE protocol. Their security model differs from ours in the fact that it does not take semi-static
keys into account (their proposed construction does not use semi-static keys). They also use the language
of state-reveals rather than ephemeral-key-reveals. Their model is stronger than the Signal-adapted-CK
model—in fact, the original Signal X3DH protocol would not satisfy their model (it requires security against
the two events E4 and E8 in Table 3, discussed further below). However, our goal is to propose a model
that exactly captures the security properties of the original Signal X3DH protocol, which was not the goal
of their model.
Before we begin, let us briefly recall the security notions mentioned above:
• Perfect forward secrecy (PFS) implies that an adversary who corrupts one or both of the participants’
long-term secret keys should not be able to reveal the session key of previous sessions executed by
those participants—the past remains secure. This is achieved by the use of ephemeral keys whose
corresponding secrets are erased on successfully completion of the exchange protocol. Weak PFS
implies that this PFS is only achieved if adversaries cannot interfere with the protocol during the
exchange (e.g. person-in-the-middle attack), they can only attack it after-the-fact.
• Key Compromise Impersonation (KCI) resistance captures the scenario where an adversary reveals/corrupts
the long-term secret key of a participant A: the adversary should be unable to impersonate other parties
to A (but of course, can still impersonate A to other parties).
• The Maximal Exposure (MEX) property states that, when given any one (long-term or ephemeral)
secret key of each party in an exchange, the adversary should still be unable to distinguish the real
session key from random.
Standard security models generally define keys to be either long-term or ephemeral. As a recipient in the
Signal protocol uses up to three keys, including a semi-static (medium-term) key, it is not at first obvious
how to integrate this semi-static key into such two-key models. We choose to consider it as both long-term
and ephemeral in different situations. This is discussed further in Remark 1.
We define the formal Key Indistinguishability Experiment now. We then provide a proof of security of our
construction in this model in Section 6.
4.1 Key Indistinguishability Experiment
We model n parties P1 , . . . , Pn through oracles Πji , which denotes the j-th session run by participant Pi .
We limit the number of sessions per party by 1 ≤ j ≤ S. Each oracle has access to secret keys of the
corresponding party Pi ’s fixed long-term identity key IKi , as well as the m semi-static keys SKi1 , . . . , SKim .
Let K denote the space of session keys. Each oracle also has the following local variables:
• Πji .rand—the fixed randomness of oracle i (which is deterministic based on this randomness) for its
j-th session.
• Πji .role ∈ {⊥, init, resp}—the role of participant i in their j-th exchange.
• Πji .sk id—the index ` of the semi-static key SKi` participant i uses in their exchange j.
• Πji .peer id—the index k of the alleged peer Pk in the j-th exchange of oracle i.
• Πji .peer sk id—the index ` of the alleged peer’s semi-static key SKk` used in the exchange.
• Πji .sid—the session ID.
8• Πji .status ∈ {⊥, accept, reject}—indicates whether the oracle has completed the key exchange
protocol and computed a session key for the exchange.
• Πji .session key ∈ K—the computed session key.
These values are all initialized to ⊥ at the start of the security experiment, except rand, which is initial-
ized with random coins for each oracle. The oracle status is set to accept or reject on computation of
session key.
The session ID is a feature of the security experiment, not the real protocol. We define the session id to be a
tuple (Π, IKI , IKR , SKR , EKI , [EKR ]) where I, R denote the initiator and responder respectively, Π is a
protocol identifier, and [EKR ] is optional in the protocol so may be null. We say two sessions with the same
sid are matching. This is done to restrict the adversary from making queries against any session matching
the test session for the game—to avoid trivializing security. For a session Πji we also define a partner session
to be any session Π`k for which Πji .peer id = k and Π`k .peer id = i, Πji .role 6= Π`k .role, and Πji .sid = Π`k .sid.
We say any two such sessions are partners. Note that if two sessions are partners, they are also, by definition,
matching.
Setup The security game is played between challenger C and a PPT adversary A. C will generate iden-
tity keys for the n participants, IK1 , . . . , IKn , and for each participant i, generate m semi-static keys
SKi1 , . . . , SKim . C will finally choose a uniformly random secret bit b ← {0, 1}, and provide access to the
oracles Πji to A.
Game A can adaptively make the following queries in the game:
• Send(i, j, µ)—send an arbitrary message µ to oracle Πji . The oracle will behave according to the key
exchange protocol and update its status accordingly.
• RevealIK(i)—return the secret long-term key of participant i. After this, participant i is corrupted.
• RevealSK(i, `)—return the `-th secret semi-static key of participant i. After this, SKi` is said to be
revealed.
• RevealEK(i, j)—return the ephemeral key (i.e. the random coins) of the j-th session of participant
i. After this, EKij and Πji .rand are said to be revealed.
• RevealSessionKey(i, j)—return Πji .session key. After this, session Πji is said to be revealed.
Test At some point in the game, A will issue a special Test(i, j) query exactly once. C will return Kb
to the adversary, where K0 := Πji .session key and K1 ← K (a random key from the keyspace). After this
query is made, session Πji is said to be tested. A can continue to adaptively make queries to the above Game
functions after the Test query has been issued. Finally, A outputs a bit b∗ ∈ {0, 1} as their guess.
At this point, the tested session Πji must be fresh. Freshness is defined in Definition 1, and the cases for
freshness are also summarized in Table 2 for clarity.
Definition 1 (Freshness). A session Πji , with Πji .peer id = k, is fresh if none of the following hold:
• Πji .status 6= accept.
• The session key of Πji , or any matching session, is revealed.
• If Πji .role = init:
– Both RevealIK(i) and RevealEK(i, j) are issued.
9– Πji has a partner Π`k for some `, and RevealIK(k), and either
RevealSK(k, Πji .peer sk id) (?) or RevealEK(k, `) are issued.
See Remark 1.
• If Πji .role = resp:
– Πji has a partner Π`k for some ` and both RevealIK(k) and
RevealEK(k, `) are issued.
– RevealIK(i) and either RevealSK(i, Πji .sk id) (?) or
RevealEK(i, j) are issued. See Remark 1.
• Πji has no partner session and RevealIK(k) is issued.
To define security in this model, we require correctness and soundness. Soundness ensures that, if the
adversary is restricted to making only reveal queries which keep the test session fresh, then its advantage in
distinguishing the session key from random is negligible. Let fresh(session) return true if session is fresh,
and false otherwise.
Definition 2. Let A be a PPT adversary. We define the advantage of A in winning the above key in-
distinguishability experiment exp with n parties, m semi-static keys per party, and S sessions per party,
as:
1
Advexp ∗
n,m,S (A) = Pr [ b = b ∧ fresh(test session) ] −
2
An authenticated key exchange protocol Π is secure in the Signal-adapted-CK model if it is:
Correct: any two parties following the protocol honestly derive the same sid, session key, and both arrive
at an accept state.
Sound: The advantage Advexpn,m,S (A) ≤ negl.
We emphasize that Table 2 and our definition of freshness in Definition 1 are strictly weaker than the
standard eCK/CK+ cases/definitions—specifically, we have removed the adversary’s ability to perform two
specific cases of a KCI attack. Both these removed cases are given in Table 3, and correspond to the extra
restrictions on freshness marked with a (?) in Definition 1. These are the cases which weaken the eCK/CK+
models to our Signal-adapted-CK model.
This is because the original Signal X3DH protocol does not satisfy these properties, and our goal is to pre-
cisely model the security of that original protocol. Hence, these cases should be excluded. The KCI attack
on the original protocol is as follows: if Bob’s semi-static key SKB is compromised, an adversary can imper-
sonate anyone to Bob. This is because Alice is only authenticated through DH1 (the exchange with SKB ),
so an adversary can claim the use of any other public key IDE and calculate the correct Diffie-Hellman value
with SKB . Because SKB is periodically replaced by Bob, the impersonation to Bob can last only as long
as he accepts exchanges with that particular SKB . However we consider this a failure of the KCI property
as SKB is not ephemeral.
Remark 1. In the original Signal X3DH protocol, the semi-static keys SK are used to strike a balance
between perfect forward secrecy and key-exhaustion denial of service. To correctly model the use of this key,
we assume it is “ephemeral enough” to have been replaced some time before a PFS attack takes place—this
is generally a longer-term attack and the cycling of the semi-static key is designed to prevent this precise
attack.
Because the semi-static key is reused and not actually ephemeral, though, we do not assume it is simply
a long term key in the other events of Table 2. In the KCI attacks, we allow it to be revealed as both
ephemeral and long-term, to properly capture various forms of key-leakage that could lead to that attack
and to strengthen the model (as mentioned above).
10Matching session
Event Case IKI EKI IKR SKR EKR Attack
exists
E1 1 No X x x X - KCI
E2 2 No x X x x* - MEX
E3 2 No x - x x* X MEX
E5 4 Yes X x X x x wPFS
*
E6 5 Yes x X x x X MEX
E7 3 Yes X x x X X KCI
Table 2: Behavior of the adversary in our model, corresponding to the various freshness cases in Definition 1.
I and R denote whether the key belongs to the initiator or responder respectively. “X” means the corre-
sponding secret key is revealed/corrupted, “x” means it is not revealed, and “-” means it does not exist/is
provided by the adversary. * Discussed further in Remark 1
Matching session
Event Case IKI EKI IKR SKR EKR Attack
exists
E4 - No x - X X x KCI
E8 - Yes x X X X x KCI
Table 3: The two cases of the eCK/CK+ model which are NOT satisfied by Signal’s X3DH, and so are not
included in our model. This lack of KCI is exactly where these protocols break down.
The MEX cases are more interesting, however. The original Signal X3DH protocol is not secure if the semi-
static key can be revealed in cases E2 , E3 , and E6 . Hence, they are set to x in Table 2 due to our goal of
accurately capturing the security of this original Signal protocol. In the spirit of the MEX property, though,
the protocol would ideally be secure even when these three cases allowed SK to be revealed—there is no
reason to treat the semi-static key as long-term in these cases. As we will show later, our new protocol
(SI-X3DH) is secure even if these three cases marked by asterisks are changed to X.
4.2 Further security properties
We briefly discuss (full) PFS as opposed to just weak PFS, which is proved in the model above. Krawczyk [Kra05]
shows that any 2-message key-exchange protocol authenticated via public keys (without a secure shared state
already established) cannot achieve true Perfect Forward Secrecy (PFS). Despite this, it is claimed in [MP16]
that X3DH can be considered to have PFS, assuming that the identities of the users can be trusted via some
means outside the protocol. In this specific case, Bob’s signature on the semi-static key can be used to verify
that the semi-static key does indeed belong to Bob, preventing even an active attacker from tampering with
the keys Bob provides to defeat PFS (in particular, the server cannot maliciously provide semi-static keys
to Alice while pretending they came from Bob). The same holds for our proposed scheme, but will not be
discussed further in this paper—the situation is identical to the original Signal X3DH.
Another very important property of X3DH, which isn’t captured by the above security model (or in general by
the eCK or CK+ models), is that of deniability. Deniability has two flavours: offline and online deniability. A
protocol is offline-deniable if an adversary can gain no non-repudiable evidence of message authorship from a
transcript even if the long-term keys involved are compromised. On the other hand, online deniability means
that even by interacting with the target (or colluding with another user with whom the target interacts),
11the adversary cannot gain any such evidence. A protocol satisfying both offline and online deniability is
known as strongly-deniable. Unfortunately, the Signal protocol fails to achieve online-deniability, as shown
by Unger and Goldberg [UG18]—although this notion is very difficult to obtain and arguably less important
that offline-deniability. The first formal proof that offline-deniability is indeed achieved by Signal was given
by Vatandas et al. [VGIK20].
The proof of offline-deniability for Signal is essentially identical for our protocol, because of how similar the
two protocols are. The proof reduces to the Knowledge of DH (KDH) assumption and its variants (K2DH
and EKDH) which informally state that it should be infeasible for an adversary, given as input public keys for
which the secret keys are unknown, to output DH values and other public keys they do not know the secret
key to yet still satisfy DHi = DH(Pi , Qi ) type relationships. We will not formally define the assumptions
here, but refer the reader to [VGIK20]. We give a brief, informal outline of this proof in Section 6.4.
4.3 New CDH-based assumptions
Let H1 : {0, 1}∗ → K3 be a PRF whose codomain is the 3-isogeny secret key space. We also let H2 :
{0, 1}∗ → {0, 1}λ be a PRF. Both H1 and H2 are modelled as random oracles. The function pubkey from secret(α)
returns the public key corresponding to secret key α.
Verifiable CDH problem (VCDH) We define a slightly different assumption, similar to the Computa-
tional Diffie-Hellman (CDH) assumption, except with an additional “check” oracle provided by the challenge
generator.
An instance of this problem is a triple (EKA , EKB , O) where EKi ∈ SSECp,i are public keys and O is a
?
truth oracle defined as O(j 0 ) = (j 0 = SIDHpp (EKA , EKB ).
Definition 3 (Verifiable CDH problem). Given a triple (EKA , EKB , O) as above, output SIDHpp (EKA , EKB ).
Essentially oracle O is an obfuscated point function, confirming if the answer to the CDH challenge is correct
or not. So intuitively we should learn no extra information from this oracle—on all except one j-invariant
the oracle will return false, so in polynomially-many queries, the likelihood of guessing the correct j-invariant
is negligible (as in the CDH problem). We can prove a reduction to the SI-CDH problem in the random
oracle model. Let H(·) be the point function obfuscator, where H is a random oracle. Then O(j 0 ) checks
H(j 0 ) = h where, h = H(j). So if there is an adversary that makes q queries and wins, simply return one of
the inputs queried to H, winning the SI-CDH game with 1/q probability.
Honest CDH problem (HCDH) This problem models a CDH instance with an additional FO-like proof
that the first key (EKA ) was honestly generated.
An instance of this problem is a triple (EKA , EKB , π) where s is a uniformly random value in {0, 1}λ ,
and:
π = s ⊕ H2 (SIDHpp (EKA , EKB ))
EKA = pubkey from secret(H1 (s)).
Instances of this form can be generated as in Algorithm 1, for example.
Definition 4 (Honest CDH problem). Given a triple (EKA , EKB , π) as above, output SIDHpp (EKA , EKB ).
We argue that the FO-like proof leaks no information because we obviously assume that SIDHpp (EKA , EKB )
is unknown (that is the answer to the CDH problem) and s is random, thus if the CDH problem is hard
then so too is this problem. Again we give a reduction in the random oracle model. Treat H1 and H2 as
random oracles, and choose π as a random binary string. Again one of the q queries to H2 must be the
correct j-invariant. So we just choose a random 1 ≤ i ≤ q and hope the i-th query to H2 is the correct
12Algorithm 1: Honest CDH (HCDH) challenge generator
Input: Public parameters pp
Output: SIDH public keys EKA , EKB , FO-proof π for EKA
1 s ←R {0, 1}λ
2 α ← H1 (s)
3 EKA = pubkey from secret(α)
4 β ←R K2
5 EKB = pubkey from secret(β)
6 P SK = SIDHpp (EKA , EKB )
7 π = s ⊕ H2 (P SK)
8 return (EKA , EKB , π)
one, and stop the interaction on this query, returning the corresponding input to H2 . Again, this wins with
probability 1/q.
5 Using SIDH for post-quantum X3DH
Suppose, first, that we naively drop in SIDH as a replacement for DH in Figure 1. In order to prevent
adaptive attacks from either party, it suffices to require proof that certain public keys are honestly generated
(for example, requiring proof that said member knows the corresponding private key). In the case of EKA ,
this could easily be done through an FO-like transformation [HHK17], as was done in the KEM known as
SIKE [CCH+ ].
However, upon further examination we notice that Bob’s semi-static public key poses an issue. As Bob may
be offline at the time of exchange, and this key will be reused across multiple iterations of the protocol, he
cannot reveal the secret key to Alice. Even if EKA is proven to be honestly generated, this would allow a
concrete attack here in the CK security model despite Galbraith’s [Gal18, A.3] claim that using an ephemeral
key in the exchange introduces enough randomness to prevent information about the long-term secret being
leaked—in this model the adversary can use a reveal query on the private key of EKA to essentially remove
the protection it provides. The best we can hope for then is that he also provides a non-interactive proof of
honest generation of SKB , for example a signature from SKB which is a PoK, however this is undesirable
due to the inefficiency of SIDH-type signatures.
Instead, we opt to modify the original X3DH protocol somewhat, so that SKB is not used in a key exchange
with IKA (removing DH1 ). This means that even if Bob adapts SKB to learn Alice’s key, the only key he
will learn is EKA which is ephemeral and revealed to him using FO anyway. DH2 , DH3 , and DH4 all involve
only Alice’s provably honest ephemeral key so neither party can learn anything in these exchanges. So the
only thing left to resolve is in how to replace DH1 so that IKA is still used safely to implicitly authenticate
Alice. We cannot use an exchange SIDH(IKA , EKB ) for a similar reason (even ignoring that EKB is only
optional). Thus, to include the key IKA in the exchange to authenticate Alice, we are left only with the
option DH1 = SIDH(IKA , IKB ).
In this case, we must prove that the long-term keys IKA , IKB are honestly generated to ensure an adaptive
attack cannot be performed by registering multiple fake users with adaptive public identity keys. Because
these keys are fixed and registered/authenticated in advance, we do not encounter the efficiency degradation
of using a more expensive proof of each of these keys to prove knowledge of the secret key—this would have
to be verified only once per new contact. In fact, depending on the trust model we use for the server, the
verification of these proofs could be offloaded to the server at registration time, and would have no impact
on users. If we do not wish to place such trust in the server, it is simple to verify these proofs out of band at
the time of first communication with a new contact. In fact, the Signal X3DH protocol already assumes that
participants will authenticate each others public keys via some unspecified external channel, depending on
13the desired trust model [MP16]. Thus, these proofs do not change the trust model of Signal at all. Proving
SIDH public keys are honestly generated can be done using a non-interactive zero-knowledge (NIZK) proof-
of-knowledge (PoK) of the corresponding secret key. De Feo, Dobson, Galbraith, and Zobernig [DDGZ21]
present such a proof protocol, and show that using it as part of a non-interactive key exchange is much more
efficient than other protocols such as k-SIDH (in terms of isogeny computations) or generic NIZKs. Thus,
their proof is perfectly suitable for our situation.
Exactly as in Signal’s X3DH, we still also require a signature by Bob on SKB , to ensure that the server
doesn’t fake SKB and break weak perfect forward secrecy by later corrupting IKB (one of the adversarial
abilities in our security model). This poses another issue to efficiency because using an SIDH signature here
would require sending and verifying such a signature regularly—every time Bob replaces his semi-static key.
SIDH signatures are inefficient and we do not recommend their use for practical systems. Instead we suggest
using another post-quantum signature scheme, such as a hash-based signature. Whichever key Bob uses to
sign his pre-shared keys should just be registered in advance as the identity keys are.
If IKA and IKB are honestly generated then we can use DH1 = SIDH(IKA , IKB ) in the exchange without
risk of adaptive attack. Historically, H(EAB , EXY ) type protocols are referred to as the “unified model.” This
naive scheme was shown to be vulnerable to interleaving and known key attacks in Protocol 3 of [BWJM97].
Essentially, the adversary starts two sessions from the same user, Πsi,j and Πui,j (participant i thinking it is
communicating with j for the s, u-th time). The ephemeral keys Eu and Es are both forwarded to the other
session. Then the shared key of both sessions will be H(Eij , Eus ). Revealing either will reveal the session key
of the other. Compare this to the H(EAY , EBX ) scenario where H(Ejs , Eiu ) 6= H(Eju , Eis ). Including the
ephemeral keys Es and Eu individually in the hash too would prevent this attack, because the ordering would
differ between the two sessions. [JKL04] proves this to be secure (T S2) in the ROM provided knowledge
of the secret keys is proven. In the Signal case, because we additionally have DH2 = SIDH(EKA , IKB )
in the exchange, then this symmetry is already broken. So we claim that our modified DH1 computation
is secure. One other disadvantage of this modification is that it does not provide KCI security. That is, if
the adversary corrupted IKB , they could pretend to be Alice by choosing any ephemeral key they like, and
calculating DH1 using the known secret key, so Bob would accept it as coming from Alice herself. However,
as above, this was the case with the original Signal X3DH anyway (if SKB was corrupted)—so while the
impersonation can persist for longer than in X3DH (it isn’t prevented by the regular replacement of SKB ),
we believe that this change is not a major degradation in security.
Unlike traditional Diffie-Hellman, where both participants’ keys are of the form g x , in SIDH we have a more
asymmetric setup—one user must use a degree 2n -isogeny while the other uses a 3m -isogeny. In order to
make this work in X3DH where users can be both initiators and receivers, we require that each user has two
long-term identity keys, one of each degree. The 3-isogeny key is used when initiating a key exchange (that
is, by Alice), and the 2-isogeny key is used by the responder/receiver (Bob), so that there is no ambiguity
or incompatibility. This is chosen so that the sender has a slightly higher computational burden than the
receiver.
All of Bob’s semi-static keys uploaded to the server should thus be generated from 2-isogenies, as should his
one-time/ephemeral keys. Whenever Alice initiates a key exchange, her ephemeral key should be a 3-isogeny
key. Then all three (or optionally four) SIDH exchanges will work.
Thus, we arrive at our modified protocol, which we call SI-X3DH (supersingular-isogeny X3DH). The protocol
is given in Figure 3. As above, brackets in the protocol [X] denote optional values (this cannot be confused
with scalar multiplication of elliptic curve points from the context). For each instance of the protocol, Alice
would request Bob’s public key package from the Server as before. She will then generate a random seed
s and use a pre-image resistant hash function H1 to compute an ephemeral secret key esk = H1 (s). The
corresponding public key is EKA = E/hPA + [esk]QA i (where E, PA , QA are the SIDH public parameters).
14Alice Server Bob
register I , IK R
IKA I , IK R
A register IKB B
i }
upload SKB , SigB (SKB ), {EKB i
request prekey bundle
R , SK , Sig (SK ), [EK ]
IKB B B B B
Alice verifies SigB (SKB ).
s ← {0, 1}λ ; derive EKA from s.
Compute P SK and π as in Eq 1.
IKA , EKA , π, [fingerprint(EKB )]
Bob verifies π.
Compute P SK as in Eq 1.
Both Alice and Bob compute SK
Figure 3: The SI-X3DH protocol.
She will then compute pre-shared key P SK and proof π as:
DH1 = SIDH(IKA , IKB )
DH2 = SIDH(EKA , IKB )
DH3 = SIDH(EKA , SKB )
(1)
[DH4 = SIDH(EKA , EKB )]
P SK = KDF(DH1 k DH2 k DH3 k [DH4 ])
π = s ⊕ H2 (DH2 ) ⊕ H2 (DH3 ) [ ⊕H2 (DH4 ) ]
She then sends (EKA , π) to Bob, along with an identifier for herself and which of his ephemeral keys she
used in the exchange (if any). Bob can check π is valid and honest by re-computing P SK 0 using IKA and
EKA , computing s0 from π by XORing with the values H2 (DH2,3,4 ), and then recomputing esk 0 = H1 (s0 )
and checking the corresponding public key is equal to EKA . He computes P SK as in Equation 1. If the
verification of π succeeded, both Alice and Bob can compute the shared secret SK = KDF(s k EKA k
P SK). However, if verification failed, Bob should instead choose a random r ← {0, 1}λ and compute
SK = KDF(r k EKA k P SK). This way, his key will not match Alice’s and the exchange fails, while Alice
learns no information about the cause of failure (or about Bob’s secret keys).
6 Proof of security
Theorem 1. The SI-X3DH protocol presented in Section 5 is secure (correct and sound) in the Signal-
adapted-CK model of Definition 2, in the random oracle model (where H1 , H2 and KDF are modelled as
random oracles), assuming the Honest CDH and Verifiable CDH problems are hard.
Proof sketch We briefly outline the proof methodology. The proof is similar to the one given by Cohn-
Gordon et al. [CGCD+ 20], adapted to our Signal-adapted-CK model and using the Verifiable and Honest
CDH assumptions instead of the standard DDH oracle in the gap assumption. Cases E2 , E3 , and E6 require
IKA and IKB not to be revealed, so we use that as the basis for security in those cases. Similarly, cases
E1 and E7 will use the fact that EKA and IKB are not revealed, and case E5 relies on EKA and SKB not
15being revealed. Informally, the proof begins by forming a game in which the challenger guessed in advance
which session would be tested, and the peer id of that session. It will then simulate the game and insert a
VCDH or HCDH challenge into that session, showing that an adversary winning the game can be used to
successfully solve the respective hard problem. Once the cases are combined, this gives a proof of soundness
of the SI-X3DH protocol.
Proof. It is clear that two parties following the protocol honestly will become partners. It is also clear that
they will both successfully derive the same session key and enter an accept state, as an SIDH protocol has
no failure probability if both parties are faithful. Thus the SI-X3DH protocol is correct.
To prove soundness, we will use a series of game hops. The proof will require splitting into cases following
Table 2. Games 0 to 3 are common to all cases; we then break into a case-by-case proof.
Game 0. This game equals the security experiment in Section 4.1. The advantage of the adversary in this
game is Adv0 . All queries to the random oracles (H1 , H2 , KDF) are simulated in an on-the-fly manner, and
a table of (query, result) pairs is stored.
Game 1. We ensure all honestly generated SIDH keys are unique, i.e. there are no collisions. If a key is
generated which collides with any previously generated key, the challenger aborts and the adversary loses the
game. With at most n parties, S sessions per party, m medium-term (semi-static) keys per party, we have
at most n + nm + nS receiving (2-isogeny) keys, and at most n + nS sending (3-isogeny) keys. A collision
among these keys is an instance of the generalized birthday problem:
Recall that if M is the size of the domain from which N ≤ M objects are uniformly drawn, the generalized
birthday problem shows that the probability of a collision between two objects is:
N −1
Y k
p(N ; M ) = 1 − 1−
M
k=1
So,
Adv0 ≤ p(n + nm + nS; |K2 |) + p(n + nS; |K3 |) + Adv1
Where, as before, |K2 | = 2e1 and |K3 | = 3e2
Game 2. We guess in advance which session πui the adversary will call the Test() query against, and abort
if incorrect. Note that we abort with high probability—there is only a 1/nS chance of success—but the
advantages still only differ by a polynomial factor.
Adv1 = nSAdv2
Game 3. In this game we guess in advance the index of the peer of the test session πui —we guess a
v ∗ ∈ [1, . . . , n] and abort if there exists a session πvj which matches πui but v ∗ 6= v. If no such v exists we do
not abort. Note too that v is unique even if j is not, so the probability of guessing correctly is 1/n and thus:
Adv2 ≤ nAdv3
We now take each case in Table 2 separately. We shall have that:
Adv3 = Adv2,3,6
3 + Adv1,7 5
3 + Adv3
166.1 Cases E2 , E3 , E6 (MEX)
As mentioned above, these cases all rely on IKA and IKB not being revealed—the adversary should thus
be unable to compute SIDH(IKA , IKB ). This is the basis for the following part of the security proof.
Game 4. In this game, we abort if the adversary queries DH1 = SIDH(IKA , IKB ) as the first component
of a call to the KDF oracle. We call this event abort4 .
Whenever abort4 occurs, we show that we can construct an algorithm B that can solve the Verifiable CDH
problem (VCDH) defined above. As per that problem, B receives a triple (EA , EB , O). B will simulate game
3, except that it replaces IKu with EA and IKv with EB . It is guaranteed by freshness that B will never
have to output the corresponding (unknown) secret keys. However, these two keys may be used in other
sessions, so B must be able to behave in the correct way even when these keys are involved. Specifically,
there are only two cases in which B is unable to compute the session key:
1. A non-tested session between the same users u, v where u is the initiator and v is the responder.
2. A non-tested session between any user other than u, and v, where v is the responder.
In the first of these two cases, the simulator does not know SIDH(EA , EB ), which is both needed to compute
the session key but also is the answer to the VCDH challenge. In the second case, the simulator does not
know SIDH(EKE , EB ) for unknown, potentially malicious ephemeral key EKE . In all other situations, B
will know at least one of the secret keys involved in each SIDH exchange because they were all generated by
the challenger.
In the first case above, if a session key or ephemeral key reveal query is made on such a session, B returns a
random key and maintains a list of such random keys and correspondingly the keys which should have been
used to compute it. Then, to ensure that other KDF() queries made are consistent with these replaced keys,
we do the following on receipt of a query KDF(DH1 k DH2 k DH3 ): B will query O(DH1 ) and if true,
this is exactly the case where abort4 occurs, and B can return DH1 as the answer to the VCDH challenge.
Otherwise, B samples a new random key to return as the KDF response.
In the second case, we involve the FO-proof πE also sent as part of the key exchange—a proof of honest
generation for EKE . In such a session, B will check through the output table of queries A has made to
oracle H2 (which can only have polynomially-many entries). For each pair of entries (h, h0 ), we check whether
H1 (πE ⊕ h ⊕ h0 ) is the secret key of EKE . If such a pair is found, we can use this secret key to compute
SIDH(EKE , EB ). B can now use this j-invariant in a query to KDF to compute a consistent session key.
Thus, Adv(break4 ) = Advvcdh (B), and
Adv32,3,6 ≤ Advvcdh (B) + Adv4
Game 5. In this game, we replace the session key of the test session with a uniformly random key. Because
Game 4 aborts whenever a KDF oracle query is made involving DH1 , we know in this game that the adversary
never queried KDF to get the true session key. Thus, the advantage of winning this game is
Adv4 = Adv5 = 0
So we have
Adv2,3,6
3 ≤ Advvcdh (B)
17You can also read
